GeezerVison

Summary

The DuckDB and SQLite destinations built their PRAGMA table_info statement with fmt.Sprintf("PRAGMA table_info('%s');", tableName). A table name containing a single quote breaks out of the string literal, so the migration reads the wrong table, fails with a syntax error, or executes injected SQL.

Root cause

The table name comes from the source plugin's schema and is not escaped before it is placed inside the single-quoted literal. SQLite does not accept bound parameters in PRAGMA statements, and the query was shared between both destinations.

Fix

• Render the table name as a proper SQL string literal, doubling embedded single quotes (foo'bar becomes 'foo''bar'). This is the standard SQL escape for both DuckDB and SQLite and cannot terminate the literal early.
• The lookup now resolves a table whose name contains a quote instead of erroring, and no text in the name can be parsed as SQL.

Test plan

• Added TestGetTableInfoWithQuoteInTableName to both destinations. Each creates a table named foo'bar, calls getTableInfo, and asserts both columns are returned.
• On the parent commit the same call fails with a syntax error because the literal is terminated at the quote.
• go test ./plugins/destination/duckdb/client/... ./plugins/destination/sqlite/client/... runs in CI (the local environment has no Go toolchain); the package build, go vet and tests are covered by the repository workflows.

Fixes #23171